CoinGecko is warning its users to be cautious when opening emails after the cryptocurrency data aggregator experienced a security breach through its third-party email platform.
In a statement, CoinGecko that on June 5th, it detected unusual activity on its email marketing platform, GetResponse.
The firm later received confirmation that an attacker obtained and used a GetResponse employee’s login credentials to access customer accounts.
The security incident led to the exposure of user data including user names, email addresses, IP addresses, locations of email opens and other metadata such as account sign-up dates and subscription plans. CoinGecko assured though that user accounts remain secure and the passwords were not compromised.
The attacker managed to export 1,916,596 contacts from CoinGecko’s GetResponse account and used another GetResponse client’s account to send phishing emails to 23,723 emails.
CoinGecko says that it already coordinated with GetResponse to block additional email deliveries, but warns users that they may still see a surge in phishing or spam emails.
“Any email claiming to offer token airdrops by CoinGecko or GeckoTerminal are unauthorized emails sent by the attacker. We do NOT have any officially issued coins or tokens.”
CoinGecko says it is investigating the situation with GetResponse, informing affected users and reviewing its security procedures.
